CVE-2024-45813 in find-my-way
Summary
by MITRE • 09/18/2024
find-my-way is a fast, open source HTTP router, internally using a Radix Tree (aka compact Prefix Tree), supports route params, wildcards, and it's framework independent. A bad regular expression is generated any time one has two parameters within a single segment, when adding a `-` at the end, like `/:a-:b-`. This may cause a denial of service in some instances. Users are advised to update to find-my-way v8.2.2 or v9.0.1. or subsequent versions. There are no known workarounds for this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2024
The vulnerability identified as CVE-2024-45813 affects find-my-way, a popular fast and open-source HTTP router implementation that utilizes a Radix Tree data structure for efficient route matching. This router is widely used in Node.js applications for handling HTTP requests and supports various routing patterns including route parameters and wildcards. The flaw manifests when developers define routes containing multiple parameters within a single segment and append a hyphen character at the end of the pattern, such as `/:a-:b-`. This specific routing pattern triggers the generation of a malformed regular expression that can lead to catastrophic backtracking behavior.
The technical implementation of this vulnerability stems from the router's internal processing of route patterns containing multiple parameters separated by hyphens. When find-my-way encounters a pattern like `/:a-:b-`, it attempts to construct a regular expression for efficient matching but generates an incorrect pattern that can cause exponential backtracking during regex execution. This issue is classified as a regular expression denial of service vulnerability, which aligns with CWE-400 and falls under the ATT&CK technique T1499.004 for denial of service through resource exhaustion. The radix tree implementation, while efficient for normal routing operations, becomes vulnerable when processing these specific malformed patterns that result in overly complex regular expressions.
The operational impact of this vulnerability can be severe for applications relying on find-my-way for HTTP routing, as it can lead to complete service unavailability. When malicious actors craft requests that match the vulnerable route patterns, the router enters into a state of excessive CPU consumption due to the regex backtracking, effectively causing a denial of service condition that affects legitimate users. This vulnerability particularly affects systems where the router handles user-supplied input or where route patterns are dynamically constructed, as these scenarios increase the likelihood of triggering the problematic regex generation. The vulnerability demonstrates how seemingly innocuous routing patterns can create significant security implications when combined with regex processing mechanisms.
Organizations using find-my-way should immediately update to version 8.2.2 or 9.0.1 or later to address this vulnerability, as no effective workarounds exist for the issue. The update process should be prioritized across all affected systems, particularly in production environments where the router handles high volumes of traffic. Security teams should monitor their applications for any patterns that might trigger this vulnerability and consider implementing additional input validation measures to prevent malformed route patterns from being processed. The vulnerability highlights the importance of careful regex generation in high-performance routing systems and underscores the need for thorough testing of edge cases in routing pattern processing, especially when dealing with parameterized routes that include special characters like hyphens that can create ambiguous parsing scenarios.